Techniques › T1204.005 › AN0698
AN0698 Analytic 0698
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User-initiated installation of Python (pip), NodeJS (npm), or other language libraries, followed by unexpected network connections, credential access, or startup file modifications. Defender sees
pip install or npm install commands run by a non-root user, followed shortly by new .py, .sh, or .js files in hidden directories, or interpreter-based execution during boot/login.</p>- Detects
- T1204.005 Malicious Library
- Part of
- DET0252 User-Initiated Malicious Library Installation via Package Manager (T1204.005)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Execution of pip, npm, gem, or similar package managers | DC0032 Process Creation |
| auditd:PATH | New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install | DC0039 File Creation |
| NSM:Flow | http::request: Network connection to package registry or C2 from interpreter shortly after install | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PackageManagerList | Monitored package managers (e.g., pip, npm, gem, poetry, conda) |
InstallWritePaths | Directories to watch for post-install execution artifacts (e.g., ~/.local/, /usr/lib/python3.8/site-packages/) |
UserContextScope | Filter to focus on non-system accounts (e.g., interactive shell users) |
TimeWindow | Correlate install command to subsequent network/file activity (default: 5 min) |